3e522d79a5c0da6a5f54256a0796714e150b5521f80e51fca2e924459294cfa5

Analysis

max time kernel
148s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_29dbd0c19395a4e16d03d0b2cd7820e2_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260715-dn95lsaw7k
SHA256 3e522d79a5c0da6a5f54256a0796714e150b5521f80e51fca2e924459294cfa5
MD5 29dbd0c19395a4e16d03d0b2cd7820e2
SHA1 e111aa4d826dd33f3f8432db15178a80d28be730
SHA512 684005942ee6a37b4bc0b8978077a9c9a0155edf30a4b341f5122ab51a291ba74af8cd968760dfe54686da020d8d914cdb7c5e80b0d28977660a732aeec871a7
SSDEEP 12288:Wq4w/ekieZgU6KR+K98ohdYitCsRrb7Ns0dO+Qwlx:Wq4w/ekieH6KQK91hdXDb77Swr
TLSH
T1E794E1217582C037E1A71A744AE1CB7A69797D604B32B8C73BD42BAE5E702D2DB34347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3144	2977.tmp

Executes dropped EXE 1 IoCs

pid	Process
3144	2977.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_29dbd0c19395a4e16d03d0b2cd7820e2_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2977.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 3144	3644	2026-07-15_29dbd0c19395a4e16d03d0b2cd7820e2_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-15_29dbd0c19395a4e16d03d0b2cd7820e2_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_29dbd0c19395a4e16d03d0b2cd7820e2_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Users\Admin\AppData\Local\Temp\2977.tmp
  "C:\Users\Admin\AppData\Local\Temp\2977.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-15_29dbd0c19395a4e16d03d0b2cd7820e2_elex_mafia_stealc_tofsee.exe 1D25A4CB444E96B4F240DAAAB0CB91E63C44C01CFD4DB5148B00DFC5CD1A1E8E933880DB9C7B544B38F94F11AA8BCF4AF3F3C7956198CA042F8C23420209EC6E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2977.tmp

Path C:\Users\Admin\AppData\Local\Temp\2977.tmp
Size 414KB
SHA256 3aaf518d0c9e342d24822d0e2278bb885db26b202c03215c43f06e61b8e55c6c
MD5 643f3cc8d8df0163850d43e42cc00d8b
SHA1 150a922bb3b395c7cd578202b10f4da90aaea486
SHA512 76241a60697bcabfc9f1e5be6968f6db6d88d6d5ff6ed78e33a96dca3bbe7abeaf853c6403ca378bc21eb75cc952787f18ca43a548dc0393404ac6295ced82f8
SSDEEP 6144:Wucyz4obQmKkWb6ekie+ogU6BY+Oz/dXHGA0OFEh7AgG/r5kTjLugjU0JdElx:Wq4w/ekieZgU6sFXUQzLkTjyiZulx
TLSH
T1C694E0213586C037E2A706344AE5CBAA197E7D750B32A8C73BD41BAE6E746C1DB31347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download